MaraDNS

>>>when I tried it in the latest version of clang on godbolt, that it is eliminating the seeding of the entropy pool<<< This is an unverified claim. My own testing does not show TCC, GCC, nor clang “optimizing out” the code using uninitialized memory as an entropy pool. The full test is here: https://github.com/samboy/MaraDNS/tree/master/deadwood-githu... In summary: On Ubuntu, and in clang at higher levels of optimization, the uninitialized memory is made 0s, but the cryptographic pseudo random number generator still runs. Tests have been done against TCC, GCC, clang, as well as GCC and clang in Cygwin. As an aside, uninitialized memory does seem to give a little bit of entropy with GCC in cygwin, which indicates it probably did back in 2007 when I originally wrote that code (it doesn’t these days with clang with optimization, nor in U

Black-and-white thinking like this is always inaccurate. >untested The automated tests includes tests that make sure the XOF is correctly implemented. [1] >unlooked at People have been looking at my code for security holes for well over 20 years, and I have been getting multiple AI assisted security reports over the last year, things like “there’s a buffer overflow in this code which is nay to impossible to exploit, using code which hasn’t even been able to compile since 2022”. [1] https://github.com/samboy/MaraDNS/tree/master/deadwood-githu... and https://github.com/samboy/MaraDNS/tree/master/deadwood-githu...

“The software has to present a worthwhile target (ie have a substantial long term userbase) before anyone will bother to look for exploits” MaraDNS is a worthwhile target; two people have been auditing it this year, in fact: https://github.com/samboy/MaraDNS/pull/137 https://github.com/samboy/MaraDNS/security/advisories/GHSA-c...

Apologies for being confrontational; accusations of there being security holes are serious accusations in my book, and need to be backed up with solid facts. Yes, that’s how seriously I take security with the software I make available on the Internet. That number is a 32-bit number in the C code, but it’s converted in to a 16-bit number. I used “int” to have it interface with other Lua code, but safely assume “int” can fit 16 bits, and yes I do convert the number to a 16-bit one before passing it off to other Lua code: https://github.com/samboy/LUAlibs/blob/master/rg32.c#L77 Here, I assume lua_number can pass 32 bits: https://github.com/samboy/LUAlibs/blob/master/rg32.c#L45 https://github.com/samboy/MaraDNS/blob/master/coLunacyDNS/lu... https://github.com/samboy/lunacy/blob/master/src/lmathlib.c#... But it works without issue: rg32.ran

>>>The patch landing in 2021, instead of 2014, being one of those concerns.<<< What makes you think I was using Lua in 2014? Seriously, do you even know how to use “git log”? I added Lua to MaraDNS in 2020: https://github.com/samboy/MaraDNS/commit/2e154c163a465ee7ead... I patched it on my own in 2021: https://github.com/samboy/MaraDNS/commit/efddb3a92b9cee30f11... >>>you might want to recheck your assumption of how big 'int' will be uint32_t is always 32-bit: https://en.cppreference.com/c/types/integer And, yes, this can be easily checked with a tiny C program: #include <stdint.h> #include <stdio.h> int main() { uint32_t foo = 0xfffffffd; uint64_t bar = 0xfffffffd; uint32_t a = 0; for(a=0;a<20;a++) { printf("%16llx:%16llx\n",foo++,bar++); } return 0; } If there’s a system where uint32_t is 64 bits, that’s a

Shameless plug time: My own MaraDNS has been extensively audited now that we’re in the age of AI-assisted security audits. Not one single serious security bug has been found since 2023. [1] The only bugs auditers have been finding are things like “Deadwood, when fully recursive, will take longer than usual to release resources when getting this unusual packet” [2] or “This side utility included with MaraDNS, which hasn’t been able to be compiled since 2022, has a buffer overflow, but only if one’s $HOME is over 50 characters in length” [3] I’m actually really pleased just how secure MaraDNS is now that it’s getting real in depth security audits. [1] https://samboy.github.io/MaraDNS/webpage/security.html [2] https://github.com/samboy/MaraDNS/discussions/136 [3] https://github.com/samboy/MaraDNS/pull/137

https://en.wikipedia.org/wiki/MaraDNS https://maradns.samiam.org/ https://github.com/samboy/MaraDNS for really being lean&mean enough to run it effortlessly on something like (even older) Raspberry Pis or similar SBCs, or routers running things like OpenWRT/DDWrt or similar. While it has no GUI, it can do everything you asked for. F.E. snapshotting its data to file, either via its internal scripting language (Lua), or cron jobs. To be further improved by using some upstream https://en.wikipedia.org/wiki/Alternative_DNS_root which doesn't do the shit you fear in the first place, thereby maybe widening the timeframe before SHTF is hitting you. Or at least something from here https://en.wikipedia.org/wiki/Public_recursive_name_server I'd recommend Mullvad, using it ATM because it's working excellently for me, without adding any noticable lat

Still accessible here: <http://web.archive.org/web/20201029102523/https://github.com...>

Everyone has their own story, and one’s person’s experience can be very different from another person’s experience. I used egrep a whole lot, dozens of times for the automated test setup I have for my open source project. I had to spend most of an hour this morning updating that code to no longer use egrep—a non-trivial task. Here’s the amount of hassle breaking egrep has given me: https://github.com/samboy/MaraDNS/commit/afc9d1800f3a641bdf1... This is just one open source project. I’ve seen fgrep in use for well over 25 years, back on the SunOS boxes we used at the time. egrep apparently has been around for a very long time too. Just because it didn’t get enshrined in a Posix document—OK, according to Paul Eggert it was made obsolete by Posix in 1992, but apparently no one got the telegram and it’s been a part of Linux since the beg

Let me add my voice to the chorus of posters pointing out that, no, Python is not easy to embed. Back in 2004 or 2005, Firaxis decided to use Python as their embedded scripting language. They used something called “Boost Python”, a then reasonably easy to embed fork of Python, to embed Python2 in their Civilization 4 gaming engine. Soon after this, Boost Python got abandoned and Firaxis ended up having to use an outdated version of Python by the time they released their final Civilization 4 expansion. For Civilization 5, Firaxis instead used Lua, since they wanted an actively maintained code base. For my own “embed a scripting language in a DNS server” project, I went with a slightly modified Lua 5.1. The entire DNS server, including the Lua scripting engine, is a 103,936 byte sized Windows service. The stack was a little hard to grok a

That is very true, and I do my utmost to avoid any kind of vendor lock in. Testing is done in a Docker container, so the CI/CD pipeline is available in a Dockerfile and the scripts the Dockerfile imports in to the testing container. In my case: https://github.com/samboy/MaraDNS/tree/master/Docker-stuff Bug reports and support requests are handled using Github, mainly because that’s what is widely used in the industry right now, but bugs actually fixed are usually described in Git commits, where the information can easily be mirrored.

It’s also possible to run it yourself, as I point out elsewhere in the thread (complete with the Lua script to run the code). To summarize: git clone https://git.sr.ht/~samiam/MaraDNS cd MaraDNS/deadwood-github/tools/coLunacyDNS make sudo cp coLunacyDNS /usr/local/bin And the script to do the name-to-IP conversion is one of the examples included in the docs: https://github.com/samboy/MaraDNS/blob/master/deadwood-githu...

I have written a very simple (IPv4/IPv6 addresses only) DNS server which can use Lua to determine the IPs to return to the user (It was my big “do cool open source during the pandemic” project). To implement this particular problem, I whipped up this Lua script: -- This script is to be run by coLunacyDNS -- This script takes a query like 10.1.2.3.ip4.invalid. and returns the -- corresponding IP (e.g. 10.1.2.3 here) -- Change these IPs to the actual IPs the DNS server will run on bindIp = "127.0.0.1" -- We bind the server to the IP 127.0.0.1 bindIp6 = "::1" -- Localhost for IPv6 function processQuery(Q) -- Called for every DNS query received if Q.coQtype == 1 then local query = Q.coQuery if query:match("^%d+%.%d+%.%d+%.%d+%.ip4%.invalid%.$") then local ip = query:gsub("%.ip4%.invalid%.$","")

I think it’s irresponsible to let bugs languish like this. The way I handle bug reports is to say “Hey, look, I just can’t fix this right now because I’m working full time and don’t know when I’ll be able to get around to fixing this without getting paid for my work.” E.g. https://github.com/samboy/MaraDNS/issues/84 I can see why a lot of people don’t do that: It’s a little rude, and there’s a small but significant chance it’ll become a flame war. I have only once had someone get rude in a ticket when I told them “That’s not a bug report, but a support issue”; I ended up deleting the ticket. GitHub also allows you to edit or delete other people’s comments in your tickets, as well as locking the conversation.